The covered entitys (CE) subcontractor, on behalf of the CEs business relate (BA), inclusion research Institute, sent postcards to 2,200 individuals indicating they were receiving services at the CE, Developmental Disabilities Administration, Maryland Department of health and Mental Hygiene. The ce provided plug notification to HHS, affected individuals, and the media. Following the hack, the CE directed the subcontractor to cease and desist sending the postcards. OCR obtained assurances that the ce implemented the corrective actions listed. Location of hacked information: Paper/Films Business associate present: Yes